Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,112 detections
Filters
Last updated
All Time
Detection languages
1,010
660
132
77
68
Contributors
432
407
369
241
166
Categories
20,443
11,831
5,872
5,155
4,866
2,112
Platforms
2,106
5
4
3
1
Products / Services
588
468
342
116
93
MITRE Techniques
1,579
817
814
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
Detects when an attacker adds a new "Debugger" value to the "Hangs" key in the Windows Error Reporting (WER) registry path. This technique can be used to achieve persistence by registering a malicious debugger that will be invoked when an application crashes, allowing the attacker to execute arbitrary code.
This rule detects modifications to the Windows Registry that are used to hide file extensions or make files hidden. Specifically, it looks for changes to the 'HideFileExt' and 'Hidden' DWORD values within the 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' registry key. Setting 'HideFileExt' to '0x00000001' hides known file extensions, and setting 'Hidden' to '0x00000002' shows hidden files, which could be used by an attacker to manipulate visibility of malicious files.
Detects when an attacker modifies the registry value associated with the 'hhctrl.ocx' COM object to point to a custom binary. This technique can be used for persistence, as 'hhctrl.ocx' is a legitimate Microsoft HTML Help ActiveX control, and hijacking its registration can lead to arbitrary code execution.
Detects when the "Index" value of a scheduled task is modified in the registry to "DWORD (0x00000000)". This modification effectively hides the scheduled task from standard tooling like "schtasks /query", making it harder for defenders to discover.
Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.
This rule detects attempts to establish persistence by modifying the 'HtmlHelp Author' registry key. Attackers can leverage this mechanism to execute malicious code when HTML Help files are accessed, as the 'Location' value under 'Software\Microsoft\HtmlHelp Author' or 'Software\WOW6432Node\Microsoft\HtmlHelp Author' can be manipulated to point to a malicious DLL.
Detects registry persistence techniques leveraging the GlobalFlags and SilentProcessExit keys within the Image File Execution Options (IFEO) registry path. Adversaries can modify these registry keys to execute arbitrary code when a specific application starts or exits, providing a stealthy method for persistence and privilege escalation.
Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.
Detects when PowerShell code is written to the Windows Registry as part of a service's ImagePath. This technique can be used by adversaries to establish persistence and execute malicious PowerShell scripts when the service starts.
Detects the creation or modification of a registry key related to screen savers, specifically when `rundll32.exe` is used to set a screen saver executable (`SCRNSAVE.EXE`) to a `.scr` file, while excluding common legitimate system paths. This technique can be used by adversaries to establish persistence or execute malicious code through masqueraded screen saver files.
Detects attempts to tamper with Sophos antivirus functionality by modifying specific registry keys related to Tamper Protection. This rule looks for changes to 'SAVEnabled', 'SEDEnabled', or 'Enabled' keys within Sophos Endpoint Defense or SAVService paths, specifically when the value is set to '0x00000000' (disabled).
This rule detects User Account Control (UAC) bypass attempts by monitoring specific registry key modifications related to `sdclt.exe`. Attackers can manipulate these registry keys to hijack the execution flow of `sdclt.exe`, a legitimate Windows utility, to run arbitrary code with elevated privileges without triggering a UAC prompt. The rule specifically looks for modifications to `Software\Classes\exefile\shell\runas\command\isolatedCommand` or `Software\Classes\Folder\shell\open\command\SymbolicLinkValue` with a specific pattern indicating a UAC bypass technique.
This rule detects when the 'EnableLocalManifestFiles' setting for AppInstaller (winget) is activated in the Windows Registry. Enabling this setting allows users to install new packages using custom manifests, which could be abused by adversaries to install malicious software or achieve persistence.
This rule detects attempts to hijack the Antimalware Scan Interface (AMSI) COM server by modifying a specific registry key. Adversaries can change the default value of the `InProcServer32` key for the AMSI CLSID (`{fdb00e52-a214-4aa1-8fba-4357bb0072ec}`) to point to a non-existent COM server. This action prevents AMSI from loading its COM component, effectively disabling its scanning functionalities and rendering it useless for malware detection.
This rule detects attempts to bypass User Account Control (UAC) by modifying the registry to leverage the DelegateExecute verb. Specifically, it looks for modifications to registry keys ending with '\open\command\DelegateExecute' where the 'Details' field is empty, which is indicative of a fileless UAC bypass technique.
Detects the abuse of custom file open handlers by modifying registry keys to execute PowerShell commands. This technique can be used for persistence or defense evasion by adversaries to run arbitrary code when a specific file type is opened.
Detects modifications to the Windows Registry that disable the Privacy Settings Experience. This can be an attempt by an adversary to impair defenses or hide their activities by preventing privacy-related notifications or settings from appearing.
This rule detects attempts to disable Windows Defender's Potentially Unwanted Application (PUA) protection by monitoring changes to the 'PUAProtection' registry key. Specifically, it triggers when the 'PUAProtection' value is set to '0x00000000' (DWORD 0), indicating that PUA protection has been disabled.
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun. The rule specifically looks for modifications to the 'Autorun', 'CleanupString', or 'PreCleanupString' registry values within the 'VolumeCaches' key, combined with specific executable names or common suspicious paths in the 'Details' field.
Detects the modification of the 'TurnOffCheck' registry value to '1' (0x00000001) within the 'ScriptedDiagnostics' key. This action can be used to bypass defenses related to the Microsoft Support Diagnostic Tool (MSDT) Follina vulnerability, as setting this value to 1 disables checks for scripted diagnostics. An attacker might enable this to execute malicious code via MSDT without user interaction or security warnings.
Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
Page 98 of 101